Server 2000 SP4 with lsass.exe memory leak

Posted on 2010-01-04
Last Modified: 2013-12-05
Good day experts,

We are currently experiencing memory leaks from the lsass.exe process on one of our elderly Server 2000 boxes.

OS: Server 2000  5.00.2195 with SP4 - patched with latest Microsoft critical patches.
Hardware: Core2Duo 2.6 / 2GB RAM / 2x 20gig Hard drives

We have not upgraded/changed anything on the server in the last 11 months with the exception of Microsofts critical patches.
However, a few weeks ago the lsass.exe process started leaking memory, to the point that the server becomes unresponsive and requires a restart - obviously this is not ideal in a production environment.
Microsoft support acknowledge that it 'was' a known issue but was resolved in the release of Service Pack 4 (
Sadly, our 2000 server is running SP4 and we still are getting a memory leak.
The hotfix provided by Microsoft will only apply itself if the server is running SP3 or lower.

If anyone knows how to solve this problem I would highly appreciate it as our team is getting a lot of flak from the business owners as the restarts require production downtime.

Kind Regards,

BCX-Support South Africa
Question by:bcx_expexc
    LVL 17

    Expert Comment

    Do you have MS web proxy IIS running on the server? If yes can you restart the service and see if CPU go back to normal.  

    Author Comment

    Hi Tiras25,
    We are not really having any problems with the CPU usage, it is the memory usage that is climbing and then killing the server performance.
    Will the MS Web proxy IIS have any effect on memory usage?
    LVL 10

    Expert Comment

    Monitor the performance using the Process Explorer and identify the problematic processes.

    Author Comment

    Hi Fayaz,
    We ran Process Explorer when the memory leak first occured. The only process that showed high memory usage was the lsass.exe process.
    However restarting or killing that process causes the server to become unresponsive and then we are forced to restart the server.
    LVL 21

    Accepted Solution


    MS say that Lsass can use a large amount of memory is it used in AD, so do you have an AD on that machine? (

    Can you tell us what exactlly is the role of your server?


    Author Closing Comment

    Thanx all

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    My previous article  ( one possible method to get SCCM 2007 installed an…
    Moving your enterprise fax infrastructure from in-house fax machines and servers to the cloud makes sense — from both an efficiency and productivity standpoint. But does migrating to a cloud fax solution mean you will no longer be able to send or re…
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    14 Experts available now in Live!

    Get 1:1 Help Now